CVE-2026-45156

Published Jun 1, 2026

Last updated 3 months ago

CVSS high 8.1
Cloud

Overview

Description
Nextcloud is an open source content collaboration platform. From versions 0.3.0 to before 3.1.0, 5.0.0 to before 5.1.0, and 6.0.0 to before 6.4.0, a missing signature verification in User OIDC allowed a malicious ID4me authority to identify as any user. This issue has been patched in versions 3.1.0, 4.1.0, 5.1.0, 6.4.0 and 8.3.0.
Source
security-advisories@github.com
NVD status
Deferred

Risk scores

CVSS 3.1

Type
Secondary
Base score
8.1
Impact score
5.2
Exploitability score
2.8
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Severity
HIGH

Weaknesses

security-advisories@github.com
CWE-287

Social media

Hype score
Not currently trending

  1. CVE-2026-45156 Missing Signature Verification in Nextcloud User OIDC Multiple Versions https://t.co/t1sYH97bRk

    @VulmonFeeds

    1 Jun 2026

    22 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

Related CVEs

  1. Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted). The vulnerability is not present in standalone Collabora Online servers; only this deployment with CODE Server is affected.•CVE-2026-110447
  2. Ahsay AhsayCBS Improper Authentication Vulnerability•CVE-2026-105133
  3. Ahsay AhsayCBS Command Injection Vulnerability•CVE-2026-105134
  4. Citrix NetScaler Improper Input Validation Vulnerability•CVE-2026-88771
  5. Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability•CVE-2026-88772

References

Sources include official advisories and independent security research.